You can also provide a path like -l /some/directory.Using -L, you can provide a cluster number instead of a path, this may be useful sometime.If you add -d, you will also see deleted files.In the listing, the prefix is f or d to tell if the line concerns a file or a directory.The c= indicates the cluster number, s= indicates the site in bytes (which should be the same as the pretty size just after).The h letter at the end indicates that the file is supposed to be hidden.The d letter at the end indicates that the file was deleted.

Reading a fileYou can read a file using -r, the file will be wrote on the standard output:

Using -R, you can provide a cluster number instead of a path, but the file size information will be lost and the file will be rounded to the number of clusters it fits, unless you provide the -s option to specify the file size to read.You can use -x to extract the FAT filesystem directories to a directory:

fatcat disk.img -x output/

If you want to extract from a certain cluster, provide it with -c.If you provide -d to extract, deleted files will be extracted too.

Damaged file systemAssuming your disk has broken sectors, you may want to do recovering on it.The first advice is to make a copy of your data using ddrescue, and save your disk to another one or into a sane file.When sectors are broken, their bytes will be replaced with 0s in the ddrescue image.A first way to go is trying to explore your image using -l as above and check -i to find out if fatcat recognizes the disk as a FAT system.Then, you can try to have a look at -2, to check if the file allocation tables differs, and if it looks mergeable. It is very likely that is will be mergeable, in this case, you can try -m to merge the FAT tables, don't forget to backup it before (see below).

Orphan filesWhen your filesystem is broken, there are files and lost files and lost directories that we call "orphaned", because you can't reach them from the normal system.fatcat provides you an option to find those nodes, it will do an automated analysis of your system and explore allocated sectors of your filesystem, this is done with -o.You will get a list of directories and files, like this:

Note that orphan files have an unknown size, this mean that if you read it, you will get a file that is a multiple of the cluster sizes.See also: orphaned files tutorial

HackingYou can use fatcat to hack your FAT filesystem

InformationsThe -i flag will provide you a lot of information about the filesystem:

fatcat disk.img -i

This will give you headers data like sectors sizes, fats sites, disk label etc. It will also read the FAT table to estimate the usage of the disk.You can also get information about a specific cluster by using -@:

fatcat disk.img -@ 1384

This will give you the cluster address (offset of the cluster in the filesystem) and the value of the next cluster in the two FAT tables.

Directories fixingFatcat can fix directories having broken FAT chaining.To do this, use -f. All the filesystem tree will be walked and the directories that are unallocated in the FAT but that fatcat can read will be fixed in the FAT.

Entries hackingYou can have information about an entry with -e:

fatcat disk.img -e /hello.txt

This will display the address of the entry (not the file itself), the cluster reference and the file size (if not a directory).You can add the flag -c [cluster] to change the cluster of the entry and the flag -s [size] to change the entry size.See also: fun with fat tutorialYou can use -k to search for a cluster reference.

Erasing unallocated filesYou can erase unallocated sectors data, with zeroes using -z, or using random data using -S.For instance, deleted files will then become unreadables.

Disclaimer

Any actions and or activities related to the material contained within this Website is solely your responsibility.The misuse of the information in this website can result in criminal charges brought against the persons in question. The authors and www.hack4.net will not be held responsible in the event any criminal charges be brought against any individuals misusing the information in this website to break the law.